Cloudflare in Front of Your Host: What Changes?

Putting Cloudflare in front of your host makes Cloudflare the public-facing reverse proxy for traffic that passes through its proxy, while your host still runs the website and usually remains the origin server. Check DNS records, TLS settings, origin access, caching, client IP handling, and any redirects or security rules so visitors see the right site without breaking the connection to the host.

What changes when Cloudflare is in front

Without a proxy, a visitor’s browser connects directly to the server address published in DNS. With a Cloudflare-proxied DNS record, the browser connects to Cloudflare first. Cloudflare can then apply services such as TLS termination, caching, filtering, and traffic management before forwarding requests to your origin host.

This does not automatically move your application, files, database, or email to Cloudflare. Your host remains responsible for generating dynamic pages and serving any content that Cloudflare does not cache. DNS records set to DNS-only, often shown with a gray cloud in the dashboard, resolve to their configured destination rather than being proxied through Cloudflare. Not every record type can be proxied.

The route is therefore conditional: a proxied web request goes browser → Cloudflare → origin; a DNS-only request goes browser → destination. Cloudflare can also answer a request from its cache without contacting the origin, if the content and cache rules permit it.

Check DNS and the origin address

Start by confirming which records are proxied and that each points to the intended host. A wrong A or AAAA record can send Cloudflare to an old server. A CNAME can also point to an unexpected destination. Check the apex domain and relevant subdomains, such as www, separately; they may use different records and proxy settings.

• Confirm the origin IP address or hostname with your hosting provider, and compare it with the DNS target.
• Check both IPv4 (A) and IPv6 (AAAA) records. A stale IPv6 record may cause inconsistent results for users on IPv6-capable networks.
• Verify that the site’s canonical hostname works and that any redirect between the apex domain and www has only one intended destination.
• Review mail-related records, including MX and the associated SPF, DKIM, and DMARC records. Mail records should not be pointed at a web proxy; use the DNS-only setting where applicable.

Changing nameservers to Cloudflare and proxying a web record are separate steps. A domain can use Cloudflare for authoritative DNS while a particular record remains DNS-only. Also check that the domain’s nameserver delegation at the registrar matches the nameservers Cloudflare provides.

Check TLS from visitor to origin

There are two HTTPS connections to consider: the browser-to-Cloudflare connection and, when Cloudflare connects securely, the Cloudflare-to-origin connection. A working padlock in a browser confirms the first connection, but does not by itself prove that the origin connection is encrypted or correctly validated.

In Cloudflare’s SSL/TLS settings, choose a mode compatible with the host. Full (strict) requires HTTPS at the origin and a certificate Cloudflare can validate for the hostname. If the host has no suitable origin certificate, the connection may fail in that mode. Using a less strict mode can conceal an origin-certificate problem and may leave the second connection unencrypted, so it should not be treated as a general fix.

Check the certificate’s hostname coverage, validity, and installation at the host. Test HTTP and HTTPS, including the selected hostname, and look for redirect loops. A loop can occur when Cloudflare redirects HTTP to HTTPS while the origin or application interprets the forwarded request as HTTP and redirects again. Coordinate the host’s HTTPS and application settings with Cloudflare’s mode rather than stacking unexplained redirects.

Preserve client IPs and application behavior

When a request passes through a proxy, the network connection reaching the origin comes from Cloudflare rather than directly from the visitor. The origin’s ordinary connection log may therefore show a Cloudflare address. Cloudflare supplies visitor-address information in request headers, including CF-Connecting-IP; the host or application must be configured to trust the appropriate proxy and interpret forwarded headers correctly.

Do not trust a client-supplied forwarding header from arbitrary internet traffic. The origin should accept these values only when the request came through a trusted proxy, using the host’s documented configuration. Otherwise, logs, rate limits, access controls, analytics, or application behavior may record or act on the wrong address.

Also check that the origin can accept Cloudflare’s connections. Some hosting firewalls or security plugins allow only selected addresses, and overly restrictive rules can block legitimate proxy traffic. Conversely, if the origin remains directly reachable, a visitor may be able to bypass Cloudflare by connecting to the origin address. Restricting origin access to Cloudflare’s published ranges can reduce that exposure, but do so only after confirming the host’s access method and retaining a safe way to administer the server.

Caching, redirects, and common failures

Cloudflare does not necessarily cache every page simply because a record is proxied. Cache behavior depends on the product, settings, response headers, and rules. Static assets are common cache candidates; personalized pages, account areas, and changing API responses usually need careful treatment. Caching private or user-specific content publicly can expose data or show one visitor another visitor’s page.

When a site behaves differently after the change, check these areas in order:

1. Confirm DNS targets, proxy status, and whether the request reaches the expected origin.
2. Check Cloudflare’s security events and rules for a block or challenge affecting the request.
3. Compare the response when cached and uncached, and purge the relevant cache if an old asset or page is being served.
4. Inspect origin logs and error logs. A Cloudflare error page may represent a failure between the proxy and host, not a fault in the visitor’s browser.
5. Check redirects, application base URLs, and HTTPS detection when the browser repeats a redirect or reports mixed content.

For a useful diagnosis, record the affected URL, time, response status, and any Cloudflare Ray ID shown on an error page. Share those details with the host or administrator. Avoid changing several DNS, TLS, and firewall settings at once; a single controlled change makes cause and effect easier to identify.

Security and operational checks

Cloudflare can filter or challenge some traffic, but it does not replace secure application code, software updates, strong authentication, backups, or host-level protections. Rules can also block legitimate users or integrations. Review security events after enabling a rule, and scope exceptions narrowly rather than disabling protection for an entire site without understanding the impact.

Before making changes, save the existing DNS values and note the host’s required records. Afterward, test the site from more than one network or device, check forms and login flows, and verify that email still sends and receives. Keep a rollback path: if the origin is healthy but the proxy configuration is at fault, changing a record to DNS-only may help isolate the issue, though DNS caching means the change may not be visible everywhere immediately.

Frequently Asked Questions

Does Cloudflare replace my web host?
No. In the usual setup, the host still runs the website and stores its application and data. Cloudflare sits in front of proxied requests and may cache or filter traffic, but it does not automatically migrate the site.

Will Cloudflare hide my origin IP address?
It hides the origin address from ordinary DNS answers for records that are proxied, but it does not guarantee the address is secret. Other DNS records, old records, or direct exposure can reveal or permit access to the origin.

Why does HTTPS work in my browser but the site still has TLS errors?
The browser-to-Cloudflare certificate can be valid while Cloudflare cannot establish a valid HTTPS connection to the origin. Check the SSL/TLS mode and the origin certificate’s validity and hostname coverage.

Should I proxy my mail records?
No. Mail delivery uses mail-specific DNS records, not the web proxy. Keep MX records and mail hostnames DNS-only where the dashboard allows, and confirm all required mail records with your email provider.

Can I still access my host directly?
That depends on the host and its firewall. The origin may remain reachable by its IP or hostname unless access is restricted. If you limit it to Cloudflare traffic, confirm administrative access and monitoring still work.

Does turning on the proxy mean every page is cached?
No. Proxying routes eligible requests through Cloudflare; caching is a separate behavior governed by settings, rules, and response details. Verify cache behavior for each type of content, especially personalized pages.

Related

• Pixel 9a vs OnePlus 13R: Which to Buy?
• Nvidia FPS Counter: The Half Story Explained
• Apple Butterfly Keyboard Payout: Who Gets Paid